Use these requirements when evaluating any provider, including MCPPeering. They are evaluation criteria—not a claim that our proposed service already meets them.
RequirementWhat to requireEvidence to request
Authorized relationships
RequireExplicit customer and supplier approval for named accounts, orders, fields, and uses.
Request evidenceA permission map, approval record, and denied-access test results.
Access and separation
RequireServer-enforced identity and least privilege across users, customers, and supplier relationships.
Request evidenceRole design and tests for cross-customer access, exports, background jobs, and support access.
Read-only boundaries
RequireAllowlisted retrieval operations. No purchase, payment, or order-change authority.
Request evidenceCredential scopes, allowed operations, and proof that attempted writes are rejected.
Source and freshness
RequireSource identity, retrieval time, source update time where available, and visible uncertainty.
Request evidenceTraceable sample answers and stale, missing, conflicting, and unavailable-source test cases.
Revocation and audit
RequireAgreed revocation behavior, including in-flight requests and caches, with reviewable audit records.
Request evidenceMeasured revocation tests and redacted logs showing who accessed what and under which permission.
Data handling
RequireDocumented hosting, subprocessors, permitted regions, retention, deletion, and model-use terms.
Request evidenceData-flow diagram, retention and deletion tests, and applicable contractual commitments.
Operational ownership
RequireNamed owners for exceptions, incidents, recovery, supplier changes, and offboarding.
Request evidenceA runbook, recovery exercise, escalation path, support boundaries, and acceptance scorecard.